SmartHawk

5.0

中危

该样本未表现出任何异常！

重新分析

下载样本

6e6d1d4b5e8886c1ab174af4693a28de750739d2cca8d1f90baa15081ec4d7d1

e195e344481ac755905516cc42878fda.exe

分析耗时

76s

最近分析

文件大小

635.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620985534.892719 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1620985519.252719 CryptGenKey	crypto_handle: 0x002e62f8 algorithm_identifier: 0x0000660e () provider_handle: 0x002e5cc0 flags: 1 key: fl½ãBno yÇhÓý	success	1
1620985534.908719 CryptExportKey	crypto_handle: 0x002e62f8 crypto_export_handle: 0x002e5d88 buffer: f¤ÓmògiëÙE§Ù6BòÌ_èeAÎëJçNÄ¡iâ1K9@úLâÐ; 7í¹\áXE½pfHQ§ß¤åÈDn-Ü»ëü/¯-¸gk¡È{þÆ blob_type: 1 flags: 64	success	1
1620985544.330719 CryptExportKey	crypto_handle: 0x002e62f8 crypto_export_handle: 0x002e5d88 buffer: f¤R ]=õÔ55ÚðÌÄî_]5Óý$·ñØ³Åz.)4©ºÁ³ùD{Ê ¢~×$¬[t»·º^EêÕ´Ì¹â6G·¦eú$C¿¤6¸õd¢Ój blob_type: 1 flags: 64	success	1
1620985577.189719 CryptExportKey	crypto_handle: 0x002e62f8 crypto_export_handle: 0x002e5d88 buffer: f¤G¬í/Rù¯.ér¦T`L±R9êhÃ¨ÍA uÛ~f4ò¸XÄéqµuG??dö°õr³ èe]â ¼Ô0R°EµÁ7[Í> blob_type: 1 flags: 64	success	1

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620985518.455719 NtAllocateVirtualMemory	process_identifier: 192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ea0000	success	0	0
1620985518.455719 NtAllocateVirtualMemory	process_identifier: 192 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ed0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620985535.595719 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

e195e344481ac755905516cc42878fda.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620985535.158719 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	13.227.228.93
host	172.217.24.14
host	190.136.179.102
host	94.102.209.63
host	97.107.135.148

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1620985538.173719 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620985538.173719 RegSetValueExA	key_handle: 0x000003c0 value: 0»°H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620985538.173719 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620985538.173719 RegSetValueExW	key_handle: 0x000003c0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620985538.173719 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620985538.173719 RegSetValueExA	key_handle: 0x000003d8 value: 0»°H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620985538.173719 RegSetValueExA	key_handle: 0x000003d8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620985538.220719 RegSetValueExW	key_handle: 0x000003bc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	190.136.179.102:80
dead_host	97.107.135.148:8080
dead_host	192.168.56.101:49176

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-28 21:37:57

Imports

Library KERNEL32.dll:

• 0x4490e0 RaiseException

• 0x4490e4 RtlUnwind

• 0x4490e8 GetCommandLineA

• 0x4490ec GetStartupInfoA

• 0x4490f0 HeapAlloc

• 0x4490f4 HeapFree

• 0x4490f8 VirtualProtect

• 0x4490fc GetSystemInfo

• 0x449100 VirtualQuery

• 0x449104 HeapReAlloc

• 0x449108 Sleep

• 0x44910c HeapSize

• 0x449110 GetStdHandle

• 0x449114 FreeEnvironmentStringsA

• 0x449118 GetEnvironmentStrings

• 0x44911c FreeEnvironmentStringsW

• 0x449120 GetEnvironmentStringsW

• 0x449124 SetHandleCount

• 0x449128 GetFileType

• 0x44912c HeapCreate

• 0x449130 VirtualFree

• 0x449134 QueryPerformanceCounter

• 0x449138 IsDebuggerPresent

• 0x44913c GetACP

• 0x449140 IsValidCodePage

• 0x449144 InitializeCriticalSectionAndSpinCount

• 0x449148 GetStringTypeA

• 0x44914c GetStringTypeW

• 0x449150 GetTimeZoneInformation

• 0x449154 GetConsoleCP

• 0x449158 GetConsoleMode

• 0x44915c LCMapStringA

• 0x449160 LCMapStringW

• 0x449164 SetStdHandle

• 0x449168 WriteConsoleA

• 0x44916c GetConsoleOutputCP

• 0x449170 WriteConsoleW

• 0x449174 CompareStringW

• 0x449178 SetEnvironmentVariableA

• 0x44917c SetUnhandledExceptionFilter

• 0x449180 UnhandledExceptionFilter

• 0x449184 TerminateProcess

• 0x449188 GetTickCount

• 0x44918c GetFileTime

• 0x449190 GetFileSizeEx

• 0x449194 GetFileAttributesA

• 0x449198 FileTimeToLocalFileTime

• 0x44919c SetErrorMode

• 0x4491a0 CreateFileA

• 0x4491a4 GetFullPathNameA

• 0x4491a8 GetVolumeInformationA

• 0x4491ac FindFirstFileA

• 0x4491b0 FindClose

• 0x4491b4 GetCurrentProcess

• 0x4491b8 DuplicateHandle

• 0x4491bc GetFileSize

• 0x4491c0 SetEndOfFile

• 0x4491c4 UnlockFile

• 0x4491c8 LockFile

• 0x4491cc FlushFileBuffers

• 0x4491d0 SetFilePointer

• 0x4491d4 WriteFile

• 0x4491d8 ReadFile

• 0x4491dc WritePrivateProfileStringA

• 0x4491e0 FileTimeToSystemTime

• 0x4491e4 GetThreadLocale

• 0x4491e8 GetModuleHandleW

• 0x4491ec GetOEMCP

• 0x4491f0 GetCPInfo

• 0x4491f4 InterlockedIncrement

• 0x4491f8 GlobalFlags

• 0x4491fc TlsFree

• 0x449200 DeleteCriticalSection

• 0x449204 LocalReAlloc

• 0x449208 TlsSetValue

• 0x44920c TlsAlloc

• 0x449210 InitializeCriticalSection

• 0x449214 GlobalHandle

• 0x449218 GlobalReAlloc

• 0x44921c EnterCriticalSection

• 0x449220 TlsGetValue

• 0x449224 LeaveCriticalSection

• 0x449228 LocalAlloc

• 0x44922c CloseHandle

• 0x449230 GetCurrentThread

• 0x449234 ConvertDefaultLocale

• 0x449238 EnumResourceLanguagesA

• 0x44923c GetLocaleInfoA

• 0x449240 InterlockedExchange

• 0x449244 lstrcmpA

• 0x449248 GetCurrentProcessId

• 0x44924c GetModuleFileNameA

• 0x449250 InterlockedDecrement

• 0x449254 GetModuleFileNameW

• 0x449258 GlobalFree

• 0x44925c GlobalAlloc

• 0x449260 GlobalLock

• 0x449264 GlobalUnlock

• 0x449268 FormatMessageA

• 0x44926c LocalFree

• 0x449270 MulDiv

• 0x449274 lstrlenA

• 0x449278 FreeResource

• 0x44927c GetCurrentThreadId

• 0x449280 GlobalGetAtomNameA

• 0x449284 GlobalAddAtomA

• 0x449288 GlobalFindAtomA

• 0x44928c GlobalDeleteAtom

• 0x449290 FreeLibrary

• 0x449294 CompareStringA

• 0x449298 LoadLibraryA

• 0x44929c GetLastError

• 0x4492a0 SetLastError

• 0x4492a4 MultiByteToWideChar

• 0x4492a8 lstrcmpW

• 0x4492ac GetModuleHandleA

• 0x4492b0 GetProcAddress

• 0x4492b4 GetVersionExA

• 0x4492b8 VirtualAlloc

• 0x4492bc ExitProcess

• 0x4492c0 WideCharToMultiByte

• 0x4492c4 FindResourceA

• 0x4492c8 LoadResource

• 0x4492cc LockResource

• 0x4492d0 GetSystemTimeAsFileTime

• 0x4492d4 SizeofResource

Library USER32.dll:

• 0x449330 RegisterClipboardFormatA

• 0x449334 PostThreadMessageA

• 0x449338 ReleaseCapture

• 0x44933c WindowFromPoint

• 0x449340 SetCapture

• 0x449344 UnregisterClassA

• 0x449348 DestroyMenu

• 0x44934c SetRectEmpty

• 0x449350 IsZoomed

• 0x449354 SetWindowContextHelpId

• 0x449358 MapDialogRect

• 0x44935c GetDesktopWindow

• 0x449360 CreateDialogIndirectParamA

• 0x449364 GetNextDlgTabItem

• 0x449368 EndDialog

• 0x44936c SetCursor

• 0x449370 GetMessageA

• 0x449374 TranslateMessage

• 0x449378 GetActiveWindow

• 0x44937c ValidateRect

• 0x449380 PostQuitMessage

• 0x449384 GetWindowThreadProcessId

• 0x449388 EndPaint

• 0x44938c BeginPaint

• 0x449390 GetWindowDC

• 0x449394 ClientToScreen

• 0x449398 GrayStringA

• 0x44939c DrawTextExA

• 0x4493a0 DrawTextA

• 0x4493a4 TabbedTextOutA

• 0x4493a8 IsWindowEnabled

• 0x4493ac ShowWindow

• 0x4493b0 MoveWindow

• 0x4493b4 SetWindowTextA

• 0x4493b8 IsDialogMessageA

• 0x4493bc SetDlgItemInt

• 0x4493c0 GetDlgItemInt

• 0x4493c4 SetMenuItemBitmaps

• 0x4493c8 GetMenuCheckMarkDimensions

• 0x4493cc ModifyMenuA

• 0x4493d0 GetMenuState

• 0x4493d4 EnableMenuItem

• 0x4493d8 CheckMenuItem

• 0x4493dc RegisterWindowMessageA

• 0x4493e0 SendDlgItemMessageA

• 0x4493e4 WinHelpA

• 0x4493e8 IsChild

• 0x4493ec GetCapture

• 0x4493f0 SetWindowsHookExA

• 0x4493f4 CallNextHookEx

• 0x4493f8 GetClassLongA

• 0x4493fc GetClassNameA

• 0x449400 SetPropA

• 0x449404 GetPropA

• 0x449408 RemovePropA

• 0x44940c GetFocus

• 0x449410 IsWindow

• 0x449414 SetFocus

• 0x449418 GetWindowTextA

• 0x44941c GetForegroundWindow

• 0x449420 GetLastActivePopup

• 0x449424 SetActiveWindow

• 0x449428 DispatchMessageA

• 0x44942c BeginDeferWindowPos

• 0x449430 EndDeferWindowPos

• 0x449434 GetDlgItem

• 0x449438 GetTopWindow

• 0x44943c DestroyWindow

• 0x449440 UnhookWindowsHookEx

• 0x449444 GetMessageTime

• 0x449448 GetMessagePos

• 0x44944c PeekMessageA

• 0x449450 MapWindowPoints

• 0x449454 GetKeyState

• 0x449458 SetMenu

• 0x44945c GetScrollRange

• 0x449460 SetScrollPos

• 0x449464 GetScrollPos

• 0x449468 DrawStateA

• 0x44946c EqualRect

• 0x449470 DrawFocusRect

• 0x449474 GetClientRect

• 0x449478 SetForegroundWindow

• 0x44947c ShowScrollBar

• 0x449480 IsWindowVisible

• 0x449484 UpdateWindow

• 0x449488 PostMessageA

• 0x44948c GetSubMenu

• 0x449490 GetMenuItemID

• 0x449494 GetMenuItemCount

• 0x449498 CreateWindowExA

• 0x44949c GetClassInfoExA

• 0x4494a0 RegisterClassA

• 0x4494a4 GetSysColor

• 0x4494a8 AdjustWindowRectEx

• 0x4494ac MessageBeep

• 0x4494b0 GetNextDlgGroupItem

• 0x4494b4 InvalidateRgn

• 0x4494b8 SetRect

• 0x4494bc GetParent

• 0x4494c0 DeferWindowPos

• 0x4494c4 IsRectEmpty

• 0x4494c8 CopyAcceleratorTableA

• 0x4494cc CharNextA

• 0x4494d0 CharUpperA

• 0x4494d4 ScreenToClient

• 0x4494d8 GetDC

• 0x4494dc ReleaseDC

• 0x4494e0 EnableScrollBar

• 0x4494e4 SetTimer

• 0x4494e8 KillTimer

• 0x4494ec EnableWindow

• 0x4494f0 LoadCursorA

• 0x4494f4 GetCursorPos

• 0x4494f8 GetSysColorBrush

• 0x4494fc DefWindowProcA

• 0x449500 GetClassInfoA

• 0x449504 MessageBoxA

• 0x449508 LoadStringA

• 0x44950c DrawIcon

• 0x449510 SendMessageA

• 0x449514 IsIconic

• 0x449518 InvalidateRect

• 0x44951c LoadIconA

• 0x449520 GetSystemMetrics

• 0x449524 LoadBitmapA

• 0x449528 GetWindow

• 0x44952c GetWindowRect

• 0x449530 GetWindowPlacement

• 0x449534 SystemParametersInfoA

• 0x449538 IntersectRect

• 0x44953c OffsetRect

• 0x449540 SetWindowPos

• 0x449544 SetWindowLongA

• 0x449548 GetWindowLongA

• 0x44954c GetMenu

• 0x449550 CallWindowProcA

• 0x449554 GetDlgCtrlID

• 0x449558 PtInRect

• 0x44955c CopyRect

• 0x449560 SetScrollInfo

• 0x449564 GetScrollInfo

Library GDI32.dll:

• 0x449038 ExtSelectClipRgn

• 0x44903c DeleteDC

• 0x449040 GetStockObject

• 0x449044 GetMapMode

• 0x449048 GetTextMetricsA

• 0x44904c GetTextExtentPoint32A

• 0x449050 GetBkColor

• 0x449054 GetTextColor

• 0x449058 GetRgnBox

• 0x44905c ScaleWindowExtEx

• 0x449060 SetWindowExtEx

• 0x449064 ScaleViewportExtEx

• 0x449068 SetViewportExtEx

• 0x44906c OffsetViewportOrgEx

• 0x449070 SetViewportOrgEx

• 0x449074 Escape

• 0x449078 ExtTextOutA

• 0x44907c TextOutA

• 0x449080 RectVisible

• 0x449084 CreateRectRgnIndirect

• 0x449088 CreatePen

• 0x44908c GetWindowExtEx

• 0x449090 GetViewportExtEx

• 0x449094 DeleteObject

• 0x449098 IntersectClipRect

• 0x44909c ExcludeClipRect

• 0x4490a0 SetMapMode

• 0x4490a4 RestoreDC

• 0x4490a8 SaveDC

• 0x4490ac GetDeviceCaps

• 0x4490b0 CreateBitmap

• 0x4490b4 GetObjectA

• 0x4490b8 SetBkColor

• 0x4490bc SetTextColor

• 0x4490c0 GetClipBox

• 0x4490c4 BitBlt

• 0x4490c8 Polyline

• 0x4490cc SelectObject

• 0x4490d0 CreateCompatibleDC

• 0x4490d4 CreateCompatibleBitmap

• 0x4490d8 PtVisible

Library MSIMG32.dll:

• 0x4492dc TransparentBlt

Library COMDLG32.dll:

• 0x449030 GetFileTitleA

Library WINSPOOL.DRV:

• 0x44956c DocumentPropertiesA

• 0x449570 ClosePrinter

• 0x449574 OpenPrinterA

Library ADVAPI32.dll:

• 0x449000 RegOpenKeyA

• 0x449004 RegSetValueExA

• 0x449008 RegCreateKeyExA

• 0x44900c RegQueryValueA

• 0x449010 RegCloseKey

• 0x449014 RegEnumKeyA

• 0x449018 RegDeleteKeyA

• 0x44901c RegOpenKeyExA

• 0x449020 RegQueryValueExA

Library COMCTL32.dll:

• 0x449028

Library SHLWAPI.dll:

• 0x44931c PathFindFileNameA

• 0x449320 PathStripToRootA

• 0x449324 PathIsUNCA

• 0x449328 PathFindExtensionA

Library oledlg.dll:

• 0x4495bc

Library ole32.dll:

• 0x44957c CoRevokeClassObject

• 0x449580 OleInitialize

• 0x449584 CoFreeUnusedLibraries

• 0x449588 OleUninitialize

• 0x44958c CreateILockBytesOnHGlobal

• 0x449590 StgCreateDocfileOnILockBytes

• 0x449594 StgOpenStorageOnILockBytes

• 0x449598 CoGetClassObject

• 0x44959c OleIsCurrentClipboard

• 0x4495a0 CLSIDFromString

• 0x4495a4 CLSIDFromProgID

• 0x4495a8 CoTaskMemAlloc

• 0x4495ac CoTaskMemFree

• 0x4495b0 OleFlushClipboard

• 0x4495b4 CoRegisterMessageFilter

Library OLEAUT32.dll:

• 0x4492e4 VariantChangeType

• 0x4492e8 VariantInit

• 0x4492ec SysAllocStringLen

• 0x4492f0 SysStringLen

• 0x4492f4 SysFreeString

• 0x4492f8 SysAllocStringByteLen

• 0x4492fc VariantCopy

• 0x449300 VariantClear

• 0x449304 SafeArrayDestroy

• 0x449308 VariantTimeToSystemTime

• 0x44930c SystemTimeToVariantTime

• 0x449310 OleCreateFontIndirect

• 0x449314 SysAllocString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
13.227.228.93	443	192.168.56.101	49185

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	57757	239.255.255.250	3702
192.168.56.101	57759	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.